Guest signal handlers are called from a host dispatcher, so no guest PC is
a signal trampoline: return 0 for every address, as KytyPS5 and prosper do.
Co-Authored-By: Claude <[email protected]>
Wait8 and Wait16 compare the 1- or 2-byte value at the address with the
comparand and share the waiter queue of the other sizes.
sceKernelSyncOnAddressWake accepts any non-null address: libc's
__std_atomic_notify_one/all pass the atomic's own address, which for 8- and
16-bit atomics need not be 4-byte aligned.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
On Linux every module resolves its references through one global scope,
and the guest modules are listed ahead of the host prx. When a title
bundles its own libc.prx, the host libc and the other host prx bound
their references to their own NIDs to the guest libc, so the host libc
built its standard streams on top of the guest _Stdout.
The exports of guest modules, and the guest and executable imports that
a guest module satisfies, now carry a #guest suffix. The title's imports
still reach the guest modules first, and a host prx only sees host
definitions, as on Windows. sceKernelDlsym also looks for the suffixed
name.
A loop whose exits have no common post-dominator, such as a normal exit
to one s_endpgm tail beside an early-out to a kill tail, got no merge
block, and Structurize threw "loop at block N has no structured
merge/continue". With three or more exits, detectNaturalLoops threw
first, on a lookup of InvalidControlFlowId.
Such a loop now leaves through one new merge block that dispatches on
route variables. They are cleared before the header and set on each
exit edge to a target other than the latch's exit. Inner loops are
routed first; a routing that would change the natural loops throws.
A loop-exit tail branch whose in-body target is the continue block no
longer merges there, which spirv-val rejects ("Header block ... is
contained in the loop construct ..., but its merge block ... is not").
DecodeState, the draw precheck and DecodePixelStageInfo rejected every
nonzero CONSERVATIVE_Z_EXPORT (DB_SHADER_CONTROL bits 13-14).
EXPORT_LESS_THAN_Z (1) and EXPORT_GREATER_THAN_Z (2) promise that the
exported Z stays on one side of the interpolated Z. The value now
reaches the recompiler as a pixel stage field, and a pixel shader that
writes FragDepth declares DepthLess or DepthGreater next to
DepthReplacing, the SPIR-V modes RADV maps to these values. Vulkan lets
those modes only add a depth test of the interpolated Z before shading,
so a shader that keeps the promise renders the same. The reserved value
3 still throws.
The field is part of the recompile cache key, the draw key and the
serialized request (version 7), and ValidateShaders accepts both modes.
The FLAT decoder took a scalar base address (SADDR) only from a
numbered SGPR pair, so global loads, stores and atomics and
global_load/store_dword_addtid with SADDR = vcc (106) threw "FLAT
scalar address register range overflow". LLVM's GFX10 global saddr
operand accepts s, vcc, ttmp, null and off.
A two-register base may now be VCC. The address translation already
reads it as VCC_LO:VCC_HI through offsetOperand. The same helper
serves the scratch SADDR, where vcc_lo becomes the 32-bit offset.
VCC_HI, M0, EXEC and the trap temporaries still throw.
Initialize, PortOpen/Close, PortSetAttribute, PortGetQueueLevel,
PortAdvance and PortPush. One port, validation order and error codes from
the PS5 module as read by prosper; blocking push paced at granularity
samples per frame at 48 kHz like KytyPS5.
Co-Authored-By: Claude <[email protected]>
Recognize the read-direction ALU forms (add, or, adc, sbb, and, sub, xor,
cmp) that read a qword from fs:[disp32], such as the stack canary check
`xor rbx, fs:[0x28]` emitted by stack-protected functions. They were
rejected as unsupported, which blocked titles relinked on Windows.
The stub loads the TLS value and applies the operation in place, keeping
the final operation as the last flag-setting instruction and preserving
the accumulator and counter. A destination of rax uses rdx as the value
scratch so the original accumulator survives.
Refs #217
sceAjmBatchStart processes every job before it returns the batch id, so a
batch that has not been waited on is never pending: cancelling it returns 0.
A batch that was never issued or was already waited on returns INVALID_BATCH,
and a context id that was never issued returns INVALID_CONTEXT, as in shadPS4.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
F32 operands applied |x| and -x as FAbs and OpFNegate. The NVIDIA driver
returns its canonical NaN 0x7fffffff from FAbs of a NaN with a payload,
so an instruction that passes a NaN operand through on the bits, such as
v_div_fixup_f32 with |v5| = 0x7ff00000, loses the payload. RADV and
lavapipe keep it.
Clear or flip the sign bit instead, as readOperand already does for U32
operands. IEEE 754 defines abs and negate as sign-bit operations, so this
is exact for every input.
LayoutFor had no case for VK_FORMAT_A2R10G10B10_UNORM_PACK32, the format
of a COLOR_2_10_10_10 color target with the alternate component swap, so
FillDccClear could not encode its 0001, 1110 and 1111 clear codes. The
format now takes the A2B10G10R10 layout: the codes set the three color
channels alike, so both packings give the same words.
A draw into a copied target under these keys now starts from the clear
value instead of the stored texels, and clearTexel (the CB metadata pass
and storeClearTexels) returns the texel instead of throwing. Textures
and resident targets, stored as A2B10G10R10, and DccAlphaOnMsb are
unchanged. Split out of #648.
sceVideoOutRegisterBuffers2 threw "DCC presentation is not implemented"
for category 1 (DCC-compressed) buffers, which PPSA26344 registers. Such
a buffer now needs DCC metadata and the tiled layout, and dcc_control may
only use the CB_DCC_CONTROL block layout bits 0x10026c.
At a flip the keys are read behind their recorded writers, one byte per
256 bytes as in the driver's DCC model. Uncompressed keys present the
stored texels as before; a uniform clear code presents its color with a
GPU clear of the scaler's source image; a pending storage image is used
when it serves the keys. Mixed or unreadable keys, clear codes the
display format has no DCC encoding for, register-clear keys over a
pending image and a clear color wider than 32 bits throw. Buffers
without DCC take the old path.
sceFontOpenFontSet failed for every set type, so PPSA21564 drew no text
in system fonts (the title screen copyright line, credits, button
guides). It now loads the set's primary font file from
ANYPS5_SYSTEM_FONTS, or anyps5-fonts beside the executable: console
files under their own names first, then openly licensed substitutes
(Noto Sans, Noto Sans Mono, Noto Sans Thai, Noto Sans CJK). The
PS5-only JG2 set types are accepted.
System font handles use the system font context. Their faces are
loaded by FreeType in host memory: about 1 MiB per CJK face does not
fit the font memory the title sizes for the console's fonts, and
sceFontCreateRenderer then failed with ALLOCATION_FAILED. Handles of
the same font file share one copy of its bytes.
Run the SIGUSR1 handler recorded by sceKernelInstallExceptionHandler on the
target thread with a PS5 ucontext (uc_mcontext at 0x40, FreeBSD amd64
layout) of its interrupted state:
- on the calling thread, directly;
- on a thread in a libkernel wait, from an APC: the TimedWait waits are
alertable and count themselves in a per-thread wait state, so the
handler runs inside the wait, which then continues;
- on a running thread, by suspending it and redirecting it to an entry
that calls the handler and restores the possibly modified context.
Other signals return EINVAL, as in shadPS4; raising without a handler
throws. Linux still throws.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
PPSA12544's Media/Plugins modules (CommonDialog, PSN, Share) import
libSceVrSetupDialog, which no library provided, and Share, NpTrophy2,
WebBrowserDialog and NpEntitlementAccess functions that were not
exported. Add libSceVrSetupDialog and the missing functions as
unimplemented exports, except
sceNpEntitlementAccessRequestConsumeServiceEntitlement, which reports
SCE_NP_ERROR_SIGNED_OUT like
sceNpEntitlementAccessRequestConsumeUnifiedEntitlement. Their other
imports are covered by #734 and #369, and two by #407.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
PPSA12544's Unity plugins (CommonDialog, PSN) import
sceMsgDialogProgressBarInc, sceMsgDialogProgressBarSetMsg and
sceMsgDialogProgressBarSetValue from libSceMsgDialog.native, which did
not export them. As in libSceMsgDialog, they succeed while a dialog is
running and return COMMON_DIALOG_ERROR_NOT_RUNNING otherwise; the native
dialog finishes in sceMsgDialogOpen.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
scePthreadAttrGet reported a null stack address and a zero size for an
adopted thread (the main thread), and for every guest thread on Linux,
where the stack range was never recorded. A garbage collector that scans
thread stacks through scePthreadAttrGetstackaddr and
scePthreadAttrGetstacksize (Unity IL2CPP in PPSA12544) then skipped the
main thread's stack and freed objects it still referenced. The range now
comes from the host thread: GetCurrentThreadStackLimits on Windows,
pthread_getattr_np on Linux.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The AMM test writes through one mapping of a physical page and reads it
through another. The two addresses are distinct to the compiler, so GCC
13 at -O2 moved the read ahead of the write and the Linux CI check saw
the old value. The test's At helper now returns a volatile reference.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceKernelInstallExceptionHandler and sceKernelRemoveExceptionHandler threw.
They now keep one handler per allowed signal (SIGHUP, SIGILL, SIGFPE,
SIGBUS, SIGSEGV, SIGUSR1, as in shadPS4): another signal or a null handler
returns EINVAL, a second handler for a signal returns EAGAIN, and removing
clears it. Delivery is not implemented and is recorded in the technical
debt; sceKernelRaiseException still throws.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A PS5 param.json keeps defaultLanguage inside localizedParameters, next to
the language entries. The parser looked for it at the root only, then fell
back to en-US and to the first member, which is the defaultLanguage string
when no en-US entry exists (PPSA12544 has only en-GB), and threw
"expected JSON object". defaultLanguage is now read from
localizedParameters first, and the fallback takes the first language
object.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Dean